The AI Act for SMEs: what a business deploying AI needs in place

The Artificial Intelligence Act (AI Act) is attracting attention across the European Union. What does it mean for owners of small and medium-sized enterprises (SMEs)? Its impact depends on the type and risks of the AI you use, rather than your company's size. The AI Act requires SMEs to take a systematic approach: knowing which AI tools are used in the company, who is responsible for them and what risks they may pose. The requirements and obligations will be lighter and simpler for SMEs that use AI for ordinary purposes (for example administration, marketing or customer support). Here is what a business deploying AI should do:

1. An inventory of AI tools

To assess risks and set rules, you first need to know which AI systems you actually use. That is why an inventory is key. The first and most important step is therefore to create a list of all tools with AI features used in your company for work purposes. This list must include not only officially introduced systems, but also tools that staff have started using on their own to work more efficiently (e.g. publicly available versions of ChatGPT, Copilot and similar). The result of the inventory will be an internal document that should record at least the name of the system, the purpose for which it is used, the responsible person (who in the company is responsible for managing and overseeing it) and the main risks of the AI tool. It will serve as the basis for further analysis and as evidence that you are actively in control of your AI use.

2. An internal AI use policy

The second step is to create an internal policy to ensure responsible use of AI within the company. Define the approved AI tools that may be used for work purposes. Set out prohibitions or limits on what data or information must not be entered into AI tools (e.g. customers' personal data, internal know-how, financial data). Define an approval process – who decides on introducing a new AI tool and how – and who is responsible for staff questions and issues generally. How detailed and precise this policy needs to be depends on the type and risks of the AI tool. For example, if you work with an AI tool that falls into the high-risk category in the area of HR, your internal processes must meet much stricter rules – including mandatory testing of the system and appropriate human oversight.

3. Risk analysis of the AI tool

Next, analyse the risks of the AI tool and assess its real impact. Ask how the use of AI may affect those around you – customers, employees or business partners. Identify whether the AI system:

• is reliable. For example, it does not produce misleading or incorrect information that could harm someone.
• is fair. Could it disadvantage or discriminate against anyone?
• protects privacy. If it works with personal data, is this done in compliance with the GDPR and is there a legal basis for it?

The output should be a written record.

4. Monitoring and active oversight

Once the AI tool has been deployed, the phase of active oversight and monitoring begins. As AI tools are updated and evolve, and their behaviour changes, they need ongoing oversight. Monitoring includes:

1. reviewing outputs – for generative AI, it is important to have a designated person who checks the accuracy and quality of outputs before they are used,
2. tracking updates and new versions – and reassessing the risks and impact of the AI tool, and
3. recording incidents – logging problems, errors or complaints related to how the AI tool works.

The purpose of this mapping is not just a bureaucratic list. It helps you understand how your company actually works and manage the risks associated with modern technologies. Recording and regulating the use of AI tools is now a necessity for every responsible company. We recommend keeping all relevant documentation easy to find, particularly for internal needs or inspections by the national supervisory authority (e.g. the Ministry of Investments, Regional Development and Informatization or another specialised authority). The solution is to create a documentation checklist containing all the information mentioned in this article, as well as records of employee training and any security incidents. For most SMEs, preparing for the AI Act means introducing good “digital hygiene” and orderly processes.

What does it mean for an SME to be a “deployer” under the AI Act?

You are typically a deployer when you use an AI system in your own processes or with customers, even if you did not develop it. Obligations depend on how you use AI (purpose, context, risk), not on who created the technology.

What is the first practical step with the greatest impact?

Take an inventory of your AI: which tools you use (including “shadow AI”), what they are used for, who owns them, what data goes into them and what decisions they influence. Without a map of how AI is used, you cannot sensibly manage risk or set rules.

What should an internal AI use policy contain at a minimum?

A list of approved tools, prohibited types of data (personal data, unprotected trade secrets), rules for approving new tools, requirements for human review of outputs and responsibilities (tool owner, IT security, lawyer or DPO). A policy on training and prompting is also important.

When can “ordinary” use turn into a risky situation?

Pay closer attention if AI affects access to employment (HR), credit, education, healthcare, the assessment of people or safety. The risk also increases with automated decisions without human oversight, a significant impact on individuals or work with sensitive data.

How should you handle data and the GDPR when using generative AI?

Rule number one: do not send to public models anything you would not send to a third party. Specify which data is permitted, anonymise or pseudonymise it, set retention rules and check the provider's contractual terms (processor role, transfers outside the EU, training on your data).

What does “human oversight” mean in practice and how do you set it up?

Decide who reviews outputs and in which scenarios approval is required before use (e.g. customer communications, legal texts, pricing). Create simple rules: what must be checked, which sources are used and when an output must not be used without escalation.

What should monitoring look like after deployment?

Track quality (error rates, hallucinations), security (prompt injection, data leaks), drift in behaviour after model updates and incidents. Keep records: tool version, configuration changes, data sources, problem logs and corrective measures.

What “evidence” should an SME have ready for an audit or inspection?

An inventory of AI tools, the policy and training, risk assessments for key use cases, contractual documents with suppliers, incident and monitoring records and a description of human oversight. The goal is traceability: who decided, on what basis and how the risks were managed.